Private conversations. Local voice transformation. Encrypted storage and control over what stays.
Designed for iOS In development
AAlexPrivate conversation
I have the final notes.
Send them here.
Message expiry: 8 hours.
Routing information is visible.
Message content is not.
Paars prepares the content on your device. The encryption engine protects the message before it reaches the delivery service.
Prepared content → Encrypted message
A server acknowledgment confirms acceptance, not that the recipient has read the message. Delivered and Seen are separate states.
Integration of the official libsignal engine is in progress. It does not make Paars metadata-anonymous or independently audited.
Paars changes a voice recording on the sending device, before the message is encrypted. The outgoing voice payload is the transformed recording.
Record → Transform → Encrypt
Voice transformation is a Paars feature. The messaging protocol encrypts the prepared audio; the backend transports its ciphertext.
The transformation algorithm is proprietary. The visual sequence shows the processing order, not its internal method.
Before a photo is encrypted, Paars removes source metadata including GPS, EXIF, IPTC, XMP, MakerNote, JPEG comments and embedded thumbnails.
Location · Camera data · Tags · Thumbnails
Paars’s access-code policy counts incorrect attempts across app restarts. The fifth incorrect attempt triggers cleanup of app-owned local data, including conversation history, keys and Vault content.
Five incorrect access-code attempts
This policy applies to the local access code. It is not a five-attempt backend password lockout. Storage errors are not presented as a successful wipe.
Local file cleanup is not a promise of physical erasure from flash memory, system snapshots, external backups or another participant’s device.
When enabled, entering your configured duress code starts local cleanup immediately and exits Paars. It does not wait for five incorrect access-code attempts.
Configured duress code → Local cleanup → App exit
Duress is disabled until a separate code is configured. The five-attempt policy remains independent and active. Entering a normal access code unlocks protected content; entering the configured duress code triggers cleanup.
App-owned file and Keychain-item removal does not guarantee physical erasure from flash memory, OS-managed storage or backups.
Your username identifies your account. Your password unlocks the local SQLCipher database and is verified by the backend for sign-in. These are separate operations, not two separate accounts.
Local database access + Backend authentication
SQLCipher derives encryption keys from the account password. The username identifies the account; it is not an extra database-encryption key.
Single-device enforcement has been tested in the development environment. Physical-device attestation and release validation are still outstanding.
Save supported text, photos and voice messages from a conversation. The Vault retains selected content inside Paars’s encrypted local database.
Text · Photos · Voice messages
New message
Choose a default message-expiry duration, then override it for a peer or group chat. Expiry starts when the message is created, not when it is read.
Default setting → Conversation override
The optional username is stored in iOS Keychain with device-only, unlocked-device access and no iCloud synchronization. The sign-in card conceals the identifier. Your password and registered-device proof are still required.
The intended notification displays Paars and a generic “New message” alert, without a sender name or message text. Notification delivery integration remains in development.